CVE-2021-32705

Lack of ratelimit on public DAV endpoint

State: Published
Severity: 5.3 Medium
Published: Jul 12, 2021
Updated: Aug 3, 2024
Reserved: May 12, 2021

Description

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	GitHub_M

Weaknesses

CWE-799 Improper Control of Interaction Frequency

Affected Products

Product	Versions
security-advisoriesnextcloud	< 19.0.13Affected >= 20.0.0, < 20.0.11Affected >= 21.0.0, < 21.0.3Affected

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fjv7-283f-5m54
https://github.com/nextcloud/server/pull/27610
https://hackerone.com/reports/1192159
FEDORA-2021-9b421b78afvendor-advisory
FEDORA-2021-6f327296fevendor-advisory
GLSA-202208-17vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.